LWN Weekly Edition
Leading itemsSecurity
Kernel development
Distributions
Development
Linux in the news
Announcements
->Multipage format
This page
Previous weekFollowing week
| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
LWN.net Weekly Edition for September 6, 2007OOXML loses a battleThe latest round in the battle for office document formats has gone against Microsoft's Office Open XML (OOXML) submission. It certainly won't be the last we hear about it, as there is another vote in February, but it does, at least, slow down the fast-track proposal for making the format an international standard. The process has been anything but regular, with allegations of ballot box stuffing in Sweden and last minute voting class changes by eleven countries. These kinds of shenanigans do very little to enhance the reputation of the International Organization for Standardization (ISO) nor do they promote confidence in their standards. The vote, which closed 2 September, was made by members of the Joint Technical Committee, Information Technology (JTC1). Each country which is a member of ISO and wishes to join, can be either a Participating ("P") or Observing ("O") member of the committee. In order to pass, the proposal must get two-thirds support of the P members and no more than one-quarter "no" votes amongst both P and O members. In both cases, abstentions are removed before calculating the ratios. The results, announced on 4 September, were 53% "yes" votes by P members and 74% "yes" votes by P and O members, which fails both tests, though either failing is all that is required to defeat the measure. Many of the votes, on both sides, were made "with comments". The comments specify portions of the OOXML spec that need clarification or change before it can be ratified. Those comments will be passed on to the Ecma International, sponsor of the OOXML standardization proposal, to propose resolutions to the comments. Ecma is also the organization that rubber-stamped OOXML as a standard last year. They have until mid-January 2008 to submit the proposed changes and the committee members have until the Ballot Resolution Meeting (BRM) in late February to review and discuss them. Microsoft's Brian Jones estimated there would be in the neighborhood of 10,000 comments, many probably duplicates. How a committee is supposed to analyze and handle that many resolutions, in a week-long meeting, is unclear. If enough of the "no" votes are satisfied that their comments have been addressed at the meeting, they can change their votes to yes. If that vote takes place, it will be the P members in February who get to vote. It is quite possible that, similar to the run-up to this vote, O members will suddenly decide to switch to P members. At this point, OOXML proponents know roughly how many votes they need. Andy Updegrove has been following the approval process closely in his Standards Blog and reported on eleven countries upgrading from O to P status in the two weeks before the voting closed. Whether Microsoft is behind this sudden interest by these countries can only be speculated upon, but nine of them voted yes, one no, and one abstained. Regardless of why they felt the need to jump into the voting at the last minute, it certainly seems fishy. If the vote fails at the BRM, we still may not have seen the last of OOXML as a proposed international standard. All of this effort has been to "fast-track" the proposal. Ecma and Microsoft can still submit it for approval under the regular, lengthier, standardization process. That could easily take several years, which is why there is a big push to fast-track it. OOXML is a complicated, 6000+ page specification, requiring a great deal of study and consideration before a sensible decision on it can be made. By upgrading at the last minute, it certainly appears that some of that review may have been skipped. If a country was interested in the process and wanted to have more input, it seems that they might have found time to do it in the nine months of review. If it is going to be an international standard, it should, at least, be a well scrutinized standard. Predictably, Microsoft is proclaiming the voting result as a victory, of sorts, just a step along the way to ISO acceptance. In the Microsoft view, the no voters will reverse course "once their comments are resolved." Their confidence is palpable and, to opponents, galling. There is some indication that the pressure applied to national bodies resulted in a backlash, with at least one switching to a no vote because of it. It will certainly be interesting to see how some of the comments will be "resolved." Microsoft has admitted that an employee offered "marketing assistance" to offset the $2500 entrance fee for Swedish companies to join their national voting committee. More than twenty showed up, just before the vote, to vote yes. Eventually, the vote was thrown out, not because of the blatant ballot-box stuffing, but because somehow one company voted twice. Sweden ended up abstaining, which was a win for OOXML, as it clearly would have been a no vote otherwise. Microsoft has made various noises about the "inadequacies" of the Open Document Format (ODF) standard – ISO passed it with so few comments that a BRM was not required – and there is some truth buried deeply in the rhetoric. The proper response is not to propose another standard, but to improve the one that exists. ODF is implemented by multiple projects, with open source reference implementations. It is very unlikely that anyone, other than Microsoft, will be able to fully implement OOXML. It's also not clear that anyone should want to implement OOXML as international standard. Besides being complex, the proposed standard contradicts other ISO standards. It also has the kind of bug-for-bug compatibility that is one of Microsoft's calling cards. An international standard should not have to implement a sloppy collection of bugs and compatibility hacks. It should be noted that OOXML contains some very important features – some not available in ODF – but that does not make it a good standard. It should not be adopted just to appease the world's largest software maker. Microsoft is behaving like a company that is terrified of losing their near-monopoly in the office software market. If they, instead, embraced the standard – leaving behind extend and extinguish – and competed on the feature set of their office suite, their much touted "innovation" could shine. Unfortunately, for anyone with a historical perspective on Microsoft's tactics, this OOXML standardization move looks like the first act of some kind of customer lock-in scheme. There will be close scrutiny on the participants between now and the vote in February. Hopefully, we will see no more gaming of the standards process, by anyone; the committee will judge the resolutions on their technical merit, coming to a sensible decision. From what we have seen so far, that seems unlikely, but one can hope.
Relicensing: what's legal and what's rightThe ath5k driver has been through more than the usual amount of legal trouble. This driver, for Atheros wireless chipsets, was originally reverse engineered and developed in the BSD community. It was reputed by some to have been improperly copied from proprietary Atheros code, requiring two different studies by the Software Freedom Legal Center before Linux developers were willing to believe that it was safe to use. This driver should be the cause of great joy - it will make it possible for vast numbers of laptop owners to run Linux with free drivers for the first time. But, first, there would appear to be one more set of legal hassles to overcome. The latest trouble started when wireless developer Jiri Slaby posted a patch which stripped the ISC and BSD license notices from the source, replacing them with GPLv2 license text. It should be noted that this patch was not accepted into any repository anywhere and never became part of any exported Linux kernel tree. Nonetheless the BSD community exploded in a very public way. It is interesting to compare their public response to this posting with the sort of response they very loudly insisted was their due when they were found to have carried improperly relicensed GPL code in their repository for some time. That notwithstanding, it is worth taking the time to look at what has happened here. The situation this time around is an interesting one. Much of the affected code was written by Reyk Floeter for OpenBSD and explicitly placed by him under a BSD-style license. The patch posted by Jiri Slaby stripped his license text; it was thus a clear violation of Reyk's license (which requires that the license text be preserved) and the wrong thing to do. This patch was never applied, and it will not be. There is no interest in the kernel community in violating anybody's license. Much of the code, however, had been written earlier by Sam Leffler. He had used the BSD license, but had also included this text:
Alternatively, this software may be distributed under the terms of
the GNU General Public License ("GPL") version 2 as published by
the Free Software Foundation.
So, when this code was relicensed under GPLv2, that act was clearly carried out with the permission of the copyright holder. Mr. Leffler has since confirmed that this act was, by his intent, explicitly allowed. Nobody can complain about the legality of this particular change. This did not stop OpenBSD leader Theo de Raadt from condemning the relicensing and calling it illegal:
It may seem that the licenses let one _distribute_ it under either
license, but this interpretation of the license is false -- it is
still illegal to break up, cut up, or modify someone else's legal
document, and, it cannot be replaced by another license because it
may not be removed. Hence, a dual licensed file always remains
dual licensed, every time it is distributed.
How to square this statement with the clear notice saying that the code may be distributed under either license is left as an exercise for the reader. By this interpretation the BSD license becomes rather more viral than the GPL; it cannot be removed even when the copyright notice says otherwise. The BSD people are fine with their code being locked up and made completely proprietary, but it would seem that a GPLv2 relicensing, even when explicitly allowed by the copyright owner, is a different matter entirely. The situation has since been resolved with this patch, which was prepared with the help of the Software Freedom Law Center. It is, perhaps, the only kernel patch ever to have been signed off by Bradley Kuhn. All of the required copyright attributions are now in place, and BSD-licensed code retains that license. Some of the additions made by Linux developers, however, remain under GPLv2, making the ath5k module, as a whole, a GPLv2-only product. This solution should keep the lawyers happy, but certain members of the BSD community remain unimpressed. Quoting Theo de Raadt again:
When companies have taken our wireless device drivers, many many of
them have given changes and fixes back. Some maybe didn't, but
that is OK.
When Linux took our changes back, they immediately locked the door against changes moving back, by putting a GPL license on guard. Why does our brother Linux take a file that is 90% BSD licensed, and refuse to let us see the 10% he adds? It is a rare day in which Theo declares brotherhood with the Linux community. It may be tempting to dismiss this statement entirely, but, still, there is a point here. This code was obtained from developers who placed it under the BSD license; it was not written in the Linux community. There is something to be said for keeping it under a permissive license so that ongoing development can be shared between the Linux and BSD communities. Maintaining the license would be a neighborly (or even brotherly) thing to do, but it could also have immediate benefits in the form of shared maintenance and good will going forward. In the end, distributing versions of the ath5k driver under GPLv2 (with the requisite copyright attributions maintained) is something which the Linux community is entitled to do. Anybody who does not like more restrictive conditions being applied to BSD-licensed code is well advised to avoid using the BSD license to begin with. But the legal ability to do something does not make that something the right course of action. Only the developers who have worked on the ath5k driver have the right to decide which license they will use, but it's worth saying that allowing the BSD community to make use of work done on the ath5k driver would be a friendly gesture and an acknowledgment of the value of the code we got from them. The benefits from such an act would likely outweigh any cost associated with allowing unwanted proprietary use of the code which has been added to this driver.
LCE: Linux, hardware vendors, and enterprise distributorsEnterprise distributions are an important part of the economic success story of Linux. The creation of highly stable, highly supported distributions has brought significant revenue streams to some distributors and enabled the deployment of Linux into many "mission critical" situations. Enterprise distributions encourage the commercial world to take Linux seriously. At LinuxConf Europe, however, your editor has stumbled into a few conversations which characterized enterprise distributions as one of the bigger problems the development community has now. Then a talk by Dirk Hohndel made that point again in a different context.
There were some suggestions on what to tell hardware vendors who are thinking about adding open source support for their products. Development in the open is crucial; drivers should be released early and made available for the community to work with. Intel did this with some of its early network drivers; the resulting level of interest and community participation exceeded all expectations. Vendors need to understand that they cannot design software just for their device, that they need to think bigger. This is a hard message for vendors to hear, but, in the long run, they benefit from a better kernel which will be better suited to their needs in the future. It is important that software support be available immediately when the hardware is made available. If there is no driver for several months after the hardware release, competitors will have had time to get their answering products to market before Linux users can use the original product. That sort of time lag is forever in the hardware world. Vendors also need to continue to maintain their code after it gets into the mainline; there is nobody else who can ensure that it continues to work on all versions of the hardware. One thing that the community could do to help would be to improve the tone of the discussion on our mailing lists. That tone is often quite hostile; it does not create a friendly environment for engineers working for hardware vendors who want to engage with the community. There is another place where life gets difficult for hardware vendors, though; this is where the enterprise distributors come in. When Intel releases a driver for a new product, that driver goes into the mainline kernel. But the release cycle implemented by the enterprise distributors will not pick up that driver for as much as two years after it gets into the mainline. So enterprise customers are not able to make use of that hardware for a long time after its release, even though the driver is available. Intel has competitors which will never release free drivers for their hardware. But they do put out closed-source modules for the enterprise distributions. So their customers are able to use that hardware from the outset. In other words, Intel is being punished for playing by the rules and releasing their drivers to the community. This is exactly the wrong sort of incentive to create for hardware vendors. If they conclude that they will do better by just shipping binary-only modules, that is the course they will take. Dirk's complaint echoes other conversations your editor has heard in the last few days. The development community has been very insistent in its message that code should be merged upstream, and that this merge should happen early. In the kernel area, the development cycle has been shortened to the point that changes find their way into a stable release after a maximum of a few months. But the enterprise distributions, by freezing kernels for years at a time, are pushing us back to the old, multi-year development cycle and sending a very different message to vendors. The discussion of enterprise distributor policies is not new; see this article from last June for a previous installment. But this discussion appears to be reaching a new level of urgency, with some developers calling enterprise distributions one of the biggest problems the community is facing today. There is a fundamental conflict between the fast-moving development community and the sort of stasis that the enterprise distributions try to create. This conflict becomes especially acute when customers want the best of both worlds: no changes combined with fast-moving development and support for current hardware. There are no easy solutions in sight. The enterprise distributions may be forcing a model from the proprietary software world on Linux, but there are reasons for the creation of that model in the first place. The kernel development community has gotten quite good at integrating vast numbers of changes while still producing a stable result, but any software which has recently seen significant changes will occasionally produce unwelcome surprises when dropped into a production environment. Slowing the rate of development is not an option, and it should be noted that the enterprise distributors are at the top of the list of companies which are setting the pace. Getting around this problem is going to be a challenge - but this community is good at facing challenges.
LWN advertising updateThe reader survey back in February provided lots of interesting feedback, from the responses as well as the comments. We have been slowly implementing some of the suggestions and we are not finished yet. Some of the comments indicated that more advertising would be tolerated, perhaps even encouraged. With that in mind, we have been exploring more options in that area. We are very aware of the fine line that must be walked here. The last thing we (or our advertisers) want to do is to annoy our loyal readers, so we are proceeding cautiously. The latest advertising technique we are trying is "in-text advertising". The idea is to serve ads that are relevant to keywords in an article by highlighting those words and popping up an ad when a reader rolls over the word with their mouse. We have also added the ability of subscribers – at any level – to choose whether they see them or not. Our "project leader" subscribers have long had the ability to turn off all advertising via the customization options behind the "My Account" link. For in-text advertising, we defaulted the option to "off"; subscribers can alter that if they wish and "project leaders" can control those ads independently of other advertising. As with Google ads, those running with Javascript disabled will not see the ads. These new ads were just added late last week, and we are still fine tuning, but we hope it is a relatively painless way to bring in some needed revenue without filling every square inch of the site with ads. We will be looking at other advertising options in the near term as well, with an eye towards maintaining a reasonable balance. As always, we are very interested in the thoughts of our readers, either via a comment below or email to lwn-AT-lwn.net. While we are on the subject, please keep the LWN text ads in mind for a very cost effective means of reaching LWN readers. If you, or someone you know, is trying to get the word out about a product, service, job, or project, the text ad box has a prominent place on roughly half of our pageviews. We are always open to hearing other advertising options, feel free to contact us at sales-AT-lwn.net to discuss.
Security Software liability laws: a dangerous solutionThe readers of LWN do not need to be reminded that the software industry as a whole has a big problem with computer security. One proposal aims to redress this state of affairs: the concept of legislation designed to create financial liability for the vendors of buggy software. This idea is applauded by many such as Bruce Schneier, author of the famous book Applied Cryptography. But despite the support of notable authors, software liability laws are themselves a dangerous liability to the software industry. One can readily find sympathy in the potential impact of software liability laws on developers of free and open-source software. Many of these developers are working on a volunteer basis, and holding them financially liable for the code they write and release freely could have a chilling effect on the development of free software. Of course, liability laws might be written to exclude programs given away for free, or they might concern themselves with vendors and leave individual developers out of the picture. Unfortunately, the dangers of software liability laws don't subside when individual developers are granted immunity. One of our community's most prominent projects, the Linux kernel, was never intended to grow off the 386 but is now found running everything from stock markets to supercomputers and military gear. This ubiquity brings demand for services, support, and a single throat to choke, which is the bread and butter of Red Hat and other businesses. When a vendor is selling free software, and we make the vendor financially liable for bugs in the code it is selling but did not write, we risk significant disruption to our cherished development models. Further complications arise when we imagine possible liability lawsuits. In the event of a security breach, directing blame and assigning liability can be problematic. Picture a system that runs Oracle on top of Red Hat Enterprise Linux, and imagine that the Oracle database is breached due to a bug in glibc. Does the buck stop with Oracle, Red Hat, or both? What if Novell provided the operating system, but the glibc developer who introduced the bug responsible for the breach is paid by Red Hat? An attorney might decide to sue all three parties, especially if it is unclear which component was vulnerable. Consider also that virtually all software developers attach disclaimers of warranty to their products. These disclaimers are nearly ubiquitous in free software licenses, and are even found attached to some public domain declarations. For software liability laws to have teeth, these disclaimers must be nullified. But when dealing with software designed to address a broad range of users, one must carefully select use cases in which default warranties apply. There is a big difference between a database full of blog postings, a database full of credit card numbers and a database full of top secret government intelligence. We must also recognize the differences in the types of failures under which warranty is considered appropriate. Ford Police Interceptors had a reputation for exploding when they were rear-ended. Ford also suffered a blow to its reputation, along with tire manufacturer Firestone, when tires on Ford Explorer vehicles were found to spontaneously fail. In both of these cases, the loss of human life was not the result of a willful human actor but was caused instead by spontaneous failure under expected operating conditions. By sharp contrast, software security breaches generally don't endanger life or limb, and successful exploits are not accidents but are rather the result of willful attack. The difference between accidental and intentional failure is an important one. Because the laws of physics and the nature of accidents do not change, we can expect auto manufacturers to build reliable gas tanks and tires. But in computer security, attackers discover new techniques each and every year. The equation for software is always on the move. At this point, advocates of software liability laws still hoping to sell their wares need to choose their words carefully, and so they plead for a standard based on best practice. But who defines best practice in an industry that is changing so fast? The pioneers of the Internet didn't predict many of the problems we're facing today, yet few would call them negligent. Real "best practice" is a moving target that is carried by the tides of the times, and in the world of technology, the waves are a mile tall and move thousands of miles per hour. These and other questions must be addressed if software liability laws are to succeed. Unfortunately, legislators are notoriously bad at understanding and regulating technology. Observers of SCO v. IBM surely agree that court cases are long, complicated and costly. Those with faith in any branch of government to appropriately legislate technology should reexamine the Digital Millennium Copyright Act, a law that continues to have a chilling effect on free software development, and Universal v. Reimerdes, the case in which 2600 Magazine's publication of DeCSS was suppressed. Security is, of course, a problem, and the case can be made that someone must be held liable. We prosecute the criminals who breach computer security, but if we're going to put burden on anyone else, we should choose the companies that leak personal information to these criminals when their security fails. In some ways, these companies might be held liable today, but we would do well to consider tightening down the screws. By increasing the burden on these data aggregators, the demand for secure software will increase. This gives the best solutions that engineers produce a market advantage, and financially rewards security-conscious vendors. This approach to liability also addresses the need for best practices and defense in depth when implementing and maintaining networks and databases. By concentrating liability in this way, we eliminate the complications that result from playing the blame game with a group of software vendors. Whose security was breached is a much easier question to litigate than how it was done and how it might have been stopped. As Schneier has pointed out, companies tend to convert variable cost liabilities into fixed cost insurance plans. Insurers have a financial incentive to excel at evaluating risk, and it isn't inconceivable that they might view the use of open code their experts can review a reason to offer lower premiums. Furthermore, putting liability on data aggregators allows those organizations to make choices on how much insurance they are willing to buy. A technologically sound small business might adopt best practices and spend less on insurance, or they might decide to skip out on insurance entirely. But if insurance were expensive and the danger of a security breach was still unacceptable, they might reconsider the practice of permanently storing large amounts of customer data, something that their customers tend to consider an invasion of their privacy anyway. Software code is quite complex, but we can write all kinds of new and useful software because it is intangible and cheap to produce. Placing liability on software vendors threatens to dramatically change this landscape. We can expect to see reduced participation, hampered innovation, and skyrocketing costs. We should carefully consider whether perfect security is a goal or an expectation, and educate users on the need for compartmentalization, defense in depth, patching, and best practices in their networks. If we approach the issue in this way, we can improve security overall with minimal risk to the efficiency of the software industry.
New vulnerabilities aide: checksum errors
clamav: multiple vulnerabilities
fetchmail: denial of service
gallery2: multiple unspecified vulnerabilities
kernel: denial of service
krb5: buffer overflow, uninitialized pointer
mapserver: multiple cross-site scripting vulnerabilities
postfix-policyd: arbitrary code execution
tcp-wrappers: unauthorized access
vavoom: multiple vulnerabilities
Updated vulnerabilities acroread: multiple vulnerabilities
apache2: information disclosure
apache: multiple vulnerabilities
apache: cross-site scripting
avahi: denial of service
bochs: buffer overflow
bugzilla: several vulnerabilities
centericq: buffer overflows
clamav: denial of service
cpio: arbitrary code execution
vixie-cron: privilege escalation
cscope: buffer overflows
cscope: buffer overflows
cups: denial of service
gpdf: integer overflow
Cyrus-SASL: DIGEST-MD5 Pre-Authentication Denial of Service
dovecot: privilege escalation
dovecot: directory traversal
elinks: code execution
elinks: arbitrary file access
emacs21: denial of service
evolution: format string error
evolution-data-server: malicious server arbitrary code execution
pop mail man-in-the-middle attacks
file: integer overflow
firebird: buffer overflow
firefox: multiple vulnerabilities
firefox: multiple vulnerabilities
firefox, thunderbird, seamonkey: multiple vulnerabilities
flac123: arbitrary code execution
freetype: arbitrary code execution
freetype: integer overflows
gcc: file overwrite vulnerability
gd: buffer overflow
gd: multiple vulnerabilities
gd: denial of service
gdm: denial of service
gedit: format string vulnerability
gimp: multiple vulnerabilities
grip: buffer overflow
gzip: multiple vulnerabilities
HelixPlayer: arbitrary code execution
horde-kronolith: local file inclusion
id3lib: insecure tmpfile creation
ImageMagick: integer overflows
jasper: denial of service
java: multiple vulnerabilities
java-1.5.0-sun: multiple vulnerabilities
kdebase: information leak
kdebase: several vulnerabilities
kdelibs: kate backup file permission leak
kernel: denial of service
kernel: denial of service
kernel: denial of service
kernel: multiple vulnerabilities
kernel: denial of service
kernel: denial of service
kernel: denial of service
kernel: denial of service by memory consumption
kernel: denial of service
kernel: several vulnerabilities
kernel: signal handling flaw on PPC
kernel: several vulnerabilities
kernel: denial of service
kernel: denial of service
kernel: multiple vulnerabilities
kernel: several vulnerabilities
krb5: multiple vulnerabilities
krb5: uninitialized pointers
krb5: local privilege escalation
krb5: multiple vulnerabilities
ktorrent: incorrect validation
lftp: shell command execution
libarchive: pax extension header vulnerabilities
libexif: integer overflow
libmodplug: boundary errors
libphp-phpmailer: command execution
libpng: denial of service
libpng: buffer overflow
libpng: heap based buffer overflow
libtiff: buffer overflow
libvorbis: multiple memory corruption flaws
libxml2 - arbitrary code execution
libxml2: multiple buffer overflows
lighttpd: denial of service
lookup-el: insecure temporary file
lynx: arbitrary command execution
mod_jk: proxy bypass
moin: arbitrary JavaScript execution
moodle: cross-site scripting
mplayer: buffer overflow
mydns: buffer overflows
mysql: denial of service
mysql: format string bug
MySQL: privilege violations
mysql: multiple vulnerabilities
MySQL: logging bypass
nbd: arbitrary code execution
ncompress: buffer underflow
nginx: cross site scripting
OpenOffice.org: arbitrary code execution
OpenSSH: denial of service
openssh: remote denial of service
openssl: private key attack
opera: multiple vulnerabilities
pam: privilege escalation
pam_ssh: authentication restriction bypass
perl-Net-DNS: predictable id sequence
php: multiple vulnerabilities
php: several vulnerabilities
php: multiple vulnerabilities
php: buffer overflows
phpbb2: missing input sanitizing
phpbb2: multiple vulnerabilities
phpPgAdmin: cross-site scripting
phpwiki: remote code execution
po4a: information leak
pptpd: denial of service
proftpd: authentication bypass
pulseaudio: denial of service
python: information disclosure
qemu: multiple vulnerabilities
qt: arbitrary code execution
qt: "/../" injection
quake: buffer overflow
redhat-cluster-suite: denial of service
rsync: off-by-one errors
slocate: information disclosure
snort: remote arbitrary code execution
star: directory traversal vulnerability
Sun JDK/JRE: multiple vulnerabilities
sylpheed: format string vulnerability
sysstat: insecure temporary files
tar: symlink path traversal vulnerability
tcpdump: integer overflow
tcpdump: denial of service
terminal: arbitrary code execution
tetex: buffer overflow
tomcat: directory traversal
tomcat: cross-site scripting
vim: arbitrary code execution
vixie-cron: weak permissions may cause errors
vlc: several vulnerabilities
wireshark: multiple vulnerabilities
wordpress: cross-site scripting
XFree86 X.org: integer overflows
xfsdump: insecure temp dir
xine-lib: arbitrary code execution
xine-lib: buffer overflow
xmms: BMP handling vulnerability
X.org: temp file vulnerability
xterm: local user unauthorized access
zziplib: buffer overflow
Page editor: Jake Edge Kernel development Brief items Kernel release statusThe current 2.6 prepatch is 2.6.23-rc5, released by Linus on August 31, immediately prior to his departure for the kernel summit. It contains a fair number of fixes; this kernel is stabilizing but has some ground yet to cover before it is ready for release.There have been a very small number of fixes added to the mainline git repository since the -rc5 release. The current -mm tree is 2.6.23-rc4-mm1. Recent changes to -mm include some significant internal sysfs implementation changes, some filesystem API changes, the sysctl() re-deprecation patches, and the container memory controller patches. The current stable 2.6 kernel is 2.6.22.6, released with a couple dozen fixes on August 30.
Kernel development news Quotes of the week
If we're going to send a message to sysadmins, we shouldn't force
them to go through a git bisection search and a lkml discussion to
receive it!
-- Andrew Morton
Judging by the number and severity of the bug reports which seem to
be flying past, 2.6.23 isn't exactly imminent.
-- Andrew Morton
LinuxConf.eu: Documentation and user-space API design![[Michael Kerrisk]](/images/conf/lce2007/mkerrisk-sm.jpg)
Michael Kerrisk, the Linux man page maintainer since 2004, gave a talk on
the value of documentation during the first day of LinuxConf Europe 2007.
While documents are useful for end users trying to get their job done, this
use was not Michael's focus; instead, he talked about how documentation can
help in the creation of a better kernel in the first place. The writing of
documents, he says, reveals bugs and bad interface designs before they
become part of a released kernel. And that can help to prevent a great
deal of pain for both kernel and user-space developers.
Michael presented three examples to show how the process of writing documentation can turn up bugs:
The existence of buggy interfaces in stable kernel releases is, says Michael, a result of insufficient testing of -rc kernels during the development process. Better documentation can help with this problem. Better documentation can also help with the API design process in the first place. Designing good APIs is hard, and is made harder by the fact that, for the kernel, API design mistakes must be maintained forever. So anything which can help in the creation of a good API can only be a good thing. The characteristics of a good API include simplicity, ease of use, generality, consistency with other interfaces, and integration with other interfaces. Bad designs, instead, lack those characteristics. As an example, Michael discussed the dnotify interface - the previous attempt to provide a file-change notification service. Dnotify suffered as a result of its use of signals, which never leads to an easy-to-use interface. It was only able to monitor directories, not individual files. It required keeping an open file descriptor, thus preventing the unmounting of any filesystem where dnotify was in use. And the amount of information provided to applications was limited. Another example was made of the mlock() and remap_file_pages() system calls. Both have start and length arguments to specify the range of memory to be affected. The mlock() interface rounds the length argument up to the next page, while remap_file_pages() rounds it down. The two system calls also differ in when they apply the length argument. As a result, a call like:
mlock (4000, 6000);
will affect bytes 0..12287, while
remap_file_pages (4000, 6000, ...);
affects bytes 0..4095. This sort of inconsistency makes these system calls harder for developers to use. Many bits can be expended on how bad these interfaces are. But, asks Michael, was it all really the developer's fault? Or did the lack of a review process contribute to these problems? Many of these difficulties result from the fact that the designers of system call interfaces (kernel hackers) are not generally the users of those interfaces. To make things better, Michael put forward a proposal to formalize the system call interface development process. He acknowledges that this sort of formalization is a hard sell, but the need to create excellent interfaces from the first release makes it necessary. So he would like to see a formal signoff requirement for APIs - though who would be signing off on them was not specified. There would need to be a design review, full documentation of the interface, and a test suite before this signoff could happen. The test suite would need to be at least partially written by people other than the developer, who will never be able to imagine all of the crazy things users might try to do with a new interface. The documentation requirement is an important part of the process. Writing documentation for an interface will often reveal bugs or bad design decisions. Beyond that, good documentation makes the nature of the interface easier for others to understand, resulting in more review and more testing of a proposed interface. Without testing from application developers, problems in new APIs will often not be found until after they have been made part of a stable kernel release, and that is too late. In the question period, it was asserted that getting application developers to try out system calls in -rc kernels is always going to be hard. An alternative idea, which has been heard before, would be to mark new system calls as "experimental" for a small number of kernel release cycles after they are first added. Then it would be possible to try out new system calls without having to run development kernels and still have a chance to influence the final form of the new API. It might be easier to get the kernel developers to agree to this kind of policy than to get them to agree to an elaborate formal review process, but it still represents a policy change which would have to be discussed. That discussion could happen soon; how it goes will depend on just how many developers really feel that there is a problem with how user-space APIs are designed and deployed now.
As is often the case, discussion of interface design is often most easily done by pointing out the things one should not do. Arnd started in with system calls, which are the primary interface to the kernel. Adding new system calls is a hard thing to do; there is a lot of review which must be gotten through first (though, as discussed above, perhaps it's still not hard enough). But often the alternative to adding system calls can be worse; he raised the hypothetical idea of a /dev/exit device; a process which has completed its work could quit by opening and writing to that device. Such a scheme would allow the elimination of the exit() system call, but it would not be a more tasteful interface by any means. The ioctl() system call has long been the target of criticism; it is not type safe, hard to script, and is an easy way to sneak in ABI changes without anybody noticing. On the other hand, it is well established, easy to extend, it works in modules, and it can be a good way to prototype system calls. Again, trying to avoid ioctl() can lead to worse things; Arnd presented an example from the InfiniBand code which interprets data written to a special file descriptor to execute commands. The result is essentially ioctl(), but even less clear. Sockets are a well-established interface which, Arnd says, would never be accepted into the kernel now. They are totally inconsistent with everything else, operate on devices which are not part of the device tree, have read and write calls which are not read() and write(), and so on. Netlink, by adding complexity to the socket interface, did not really help the user-space interface situation in general; its use is, he says, best avoided. But, importantly, it is better to use netlink than to reinvent it. The wireless extensions API was brought up as another example of how not to do things; putting wireless extensions over netlink turned out to be a way of combining the worst features of sockets and ioctl() into a single interface. The "fashionable" way to design new interfaces now is with virtual filesystems. But troubles can be found there as well. /proc became a sort of dumping ground for new interfaces until the developers began to frown on additions there. Sysfs was meant to solve many of the problems with /proc, but it clearly has not solved the API stability problem. Virtual filesystems may well be the best way to create new interfaces, but there are many traps there. Finally, there was some talk of designing interfaces to make ABI emulation easy. Arnd suggests that data structures should be the same in both kernel and user space. Avoid long variables, and, whenever possible, avoid pointers as well. Structure padding - either explicit or caused by badly aligned fields - can lead to trouble. And so on. All told, it was a lively session with a great deal of audience participation. There are many user-space interface design mistakes which are part of Linux and must be supported forever. There is also a great deal of interest in avoiding making more of those mistakes in the future. The problem remains a hard one, though, even with the benefit of a great deal of experience.
The many faces of fsckWhen people talk about fsck they not only pronounce it in wildly different ways, but they also mean wildly different actions. For example, they might mean "traverse the entire file system looking for obvious errors," "run a full consistency cross-check of file system metadata," "repair corruption from a disk error," "repair half-finished writes leftover from a system crash," "reconstruct a consistent file system hierarchy starting from the inodes alone," or "I'm so geeky I think it's funny to say 'fsck' instead of swearing. Is there a new xkcd up yet?" As different as all these meanings are, every one of them (except the last) has been implemented by a program referred to as fsck. The question, "Does this file system require fsck?" then becomes anything from "Does this file system need to check and repair the entire file system after every crash before mounting read-write?" to "Can this file system recover from any disk corruption event while still mounted?" In this article, we'll review the history and the various meanings of that complicated, least-beloved of file system utilities, fsck. fsck tasksFirst, what exactly does fsck - the "file system check" program - do? Many Linux users experience it as that annoying 10 minute delay in booting that happens every 180 days or 30 mounts, whichever comes first (the default ext3 "paranoia" fsck parameters). When we do run fsck, most of us run it in automatic mode. After all, how many of us can out-guess fsck when it comes to repairing internal file system structures? Probably the top 10 developers for each file system, which leaves the other 99.99% of us with the -y switch. But before we can understand the differences between fsck implementations, we have to have some idea of what it does. The most important job of fsck is to find out whether the file system makes a consistent, correctly formatted whole. This is not as simple as traversing all of the file system and incidentally making sure the metadata is good enough for reading along the way. fsck also has to do more involved cross-checks on the metadata than simply reading it, and make sure that the parts of the file system it believes are unused are in fact unused. This is the difference between having a file system that is consistent enough to read, and one that is consistent enough to write. A file system that can be read may be chock-full of reference count bugs and errors which will only cause trouble when the system attempts to actually change the file system. A car may be in good enough repair to start and idle, but then fall apart once it leaves the garage. During consistency checking, fsck double-checks the metadata describing which blocks and inodes are free, and which are allocated. Usually, some sort of allocation bitmap or tree of extents is maintained to speed up searching for free blocks or inodes - otherwise, the file system would have to check every file to see if it used a particular block, very slow going indeed. This bitmap is a distilled copy of the metadata in individual block pointers or inodes describing whether a block or inode is in use. The upside of this second copy is speed (or lack of glacial slowness, more accurately); the downside is possible inconsistency. If corruption occurs, the two copies can disagree with each other, leading to further file system corruption. The kinds of errors fsck looks for here are double-use (a block with more than one pointer to it), leaked inodes or blocks (an inode or block is marked as used but nothing refers to it), and disagreement (a block pointer points to a block or a directory entry points to an inode but it is marked as free). Orphan inodes, inodes marked as allocated but not pointed to by any directory entry deserve extra discussion. Orphan inodes are surprisingly common, due to a UNIX convention that allows a file to be unlinked (removed from the directory tree) but still open. Many programs create temporary files and unlink them in this way so they are guaranteed to be deleted even if the program doesn't shut down properly. The file system has the honor of implementing this guarantee. Many modern file systems maintain some form of on-disk delete queue - a list of inodes which need to be deleted when their reference count drops - for quick deletion in case of crash, instead of searching the entire file system for orphan inodes. Even journaling file systems must kick-start this deletion after an unclean unmount, though it is not crucial to using the file system immediately. Free/allocated consistency is particularly hard especially when it comes to blocks. Most file systems do not have any way to have back pointers for blocks to their parent, so the only way to find out if a block is really part of a file is to traverse the entire file system. Detecting duplicate block allocations requires keeping a block allocation bitmap and checking if a block is already marked before marking a block as allocated. Fixing the duplicate allocation requires keeping a list of which inode points to a block which can take a lot of memory; the ext2/3/4 fsck doesn't record this information until it detects a duplicate block, at which point it starts over and finds this information. UNIX file systems have the wonderful quality of allowing more than one hard link to an inode (which can be file or directory). The inode is not deleted until all the hard links are gone. Each inode must maintain a link count, and fsck has to check that the number of directory entries referencing an inode is exactly the same as the link count. This is checked by walking the entire directory tree and recording each link to an inode. The structure of the directories in a file system has to obey certain rules. No directory cycles can exist (e.g., directory A -> directory B -> directory A), and each directory must be reachable from the root directory of a file system. The above are the most important, generic UNIX rules for file system consistency, but there are many more things to check. Each file system then also needs to check the internal structure of its metadata. For example, if the file system uses extents, the file system must check that the extents of a file are correctly formatted and refer to plausible blocks. The superblock and the summaries for groups of blocks must be checked. Some file systems use B-trees extensively and must check them for consistency too, and so forth. One paper that may help with understanding some of the more subtle issues of file system checking is Fast Consistency Checking for the Solaris File System [PDF]. The authors implement a scheme for fast fsck with relatively minor changes to the Solaris UFS file system, in the process describing the most difficult tasks in file system consistency checking. Primordial fsck: check the file system and repair in-progress updatesFor the purposes of UNIX, the first fsck was designed for the Fast File System. (Original fsck paper in text gzipped format) As is well known, FFS had no formal method of maintaining file system consistency if the file system was not cleanly unmounted. (In fact, in the earliest days, the operator had to sync the file system by hand before shutting the system down.) Many write operations require writing more than one block on disk. If a system crash occurred, some random subset of the outstanding writes would be on disk, and the rest would not. When the system booted again, the file system would be in an inconsistent state and not usable - perhaps an inode had zero links to it, but was still marked as allocated, and therefore could never be freed. As well, corruption might occur for other reasons - a bad disk, or a file system bug - and not be found until the whole file system was checked. fsck in this earliest incarnation therefore did the following things: It checked the whole file system for inconsistencies, both from an unclean mount and other source of corruption, and in the process attempted to repair any inconsistencies it found. (Repair here means, as it does in the rest of the article, returning the file system to a usable consistent state, rather than to some platonic ideal of what the file system would have been without the corruption.) The majority of the inconsistencies were the result of an unclean unmount, and the steps to fixing them were fairly well known. The first use of fsck meant "check the file system and fix any in-progress writes that didn't complete so that the file system can be mounted." This is the use that carried over to the ext2 file system in Linux. fsck and journaling file systemsRunning fsck after every unclean unmount was an unpleasant, time-consuming, and dangerous experience. Many a sysadmin has distinct memories of lines of unintelligible gobbledygook scrolling off the screen, each ending with "Fix? <y>", and a sore finger from holding down the enter key (this was before the -y switch). The new journaling file systems, like XFS, VxFS, Reiserfs, and ext3, made running fsck after an unclean unmount unnecessary. Journaling file systems keep an on-disk log of write operations to the file system. When the entirety of a write operation is in the log, then the file system begins rewriting the changes to their final location on disk. If the system crashes or something else goes wrong, then the journal entry is still on-disk on the next mount, and the file system will finish replaying the entry, so that the entire self-consistent set of changes to the metadata will go to disk. fsck no longer had to clean up after half-finished writes, and the file system only had to replay the journal after an unclean unmount. Some file system developers initially took this to mean that no fsck was needed at all. In part, this was true - the system no longer needed to repair half-finished writes by scanning the entire file system, it only had to replay the log. But fixing half-finished writes was only one part of what fsck did. It also checked for and repaired corruption caused by disk errors, file system bugs, administrator error, and any other source. These sources of errors are less common and can be ignored in development, but become a major problem in production use. Nobody wanted to repair a journaling file system by hand any more than any other file system. fsck in the sense of "repair half-completed writes" is unnecessary for journaling file systems (or copy-on-write file systems) but it is still necessary in the sense of "check for and repair file system corruption when something unexpected goes wrong." The XFS developers decided to head off the fsck naming confusion at the pass and created two commands, xfs_check, which checks the file system for corruption, and xfs_repair, which repairs corruption. The xfs_check man page immediately clears up any confusion about when to run it:
xfs_check checks whether an XFS filesystem is consistent. It is normally run only when there is reason to believe that the filesystem has a consistency problem. The Reiser version 3 file system, reiserfs, tried something radical and new with its file system check and repair program. It had three major modes: "check," "fix fixable," and "rebuild tree." It divided file system corruption into two kinds: that which is easily fixable, and that which was handled by throwing away most of the metadata and rebuilding the entire file system tree using only the leaves as a starting point (reiserfs puts all of the file system metadata and data into one "balanced tree" structure). The file system repair program only had to deal with a limited set of "easy" corruption repairs. Anything harder just threw away all the "secondary" metadata that could be conflicting and then did a brute force search for the "primary" metadata - the leaves of the tree - and rebuilt a tree out of them. The downside of this approach is that there is no out-of-band signal to say what blocks are metadata and which are not, so it used a magic number present in reiserfs metadata to decide what should be part of the tree. Unfortunately, regular file data can have this magic number, and one common use case was to keep a reiserfs file system image in a file (to mount using the loop device) on a reiserfs file system. The result was that file systems became trivially corrupted during a tree rebuild, since the metadata leaves in the loopback became incorporated into the parent file system. fsck and soft updatesSoft updates, implemented on FFS for BSD, introduced another meaning of fsck. Soft updates is a method of recording and ordering metadata writes to the disk so that if a system crash occurs, the file system is consistent, with the exception of possible leaked inodes and blocks. When the system boots after an unclean unmount, fsck takes a snapshot of the file system (using an interesting file-based copy-on-write mechanism) and checks it, looking for leaked inodes and blocks. As soon as the snapshot is taken, the system goes forward with the normal boot process, mounting the file system read-write. When fsck finishes, it releases the leaked inodes and blocks it found and lets go of its snapshot. Soft updates gave immediate access to the file system after unclean unmount, without changing the on-disk format of the original FFS file system. fsck in this case meant two things: search for and free leaked inodes and blocks, and repair unexpected corruption. fsck and copy-on-write file systemsCopy-on-write file systems use an atomic rewrite of the top block in the file system hierarchy to switch between one consistent file system state and another. Copy-on-write file systems may have some form of logging, but this is for the purpose of swiftly recording recent changes to the file system rather than being necessary for the consistency of the file system as in journaling. For example, Write Anywhere File Layout (WAFL) keeps a log of recent writes in an NVRAM device, and ZFS keeps an intent log of recent operations. fsck for copy-on-write file systems is then restricted to the role of checking for and repairing unexpected, unlooked-for file system corruption. fsck is only run as a paranoia check or in response to some sign of corruption. Not much information is available on the file system check and repair tools for WAFL, other than that they exist. Searching for the file system check and repair tool for WAFL, wafl_check, only gives about 100 results from Google. The online consistency check tool is named wafliron (ha!) and had about 100 results as well. ZFS's file system check and repair facilities don't follow the usual interface boundaries. The zdb command, used for debugging ZFS, has an undocumented option which will cause it to traverse the entire file system tree, checking checksums as it goes, for a basic consistency check. (Undocumented, because, as the man page says, "The zdb command is used by support engineers to diagnose failures and gather statistics. Since the ZFS file system is always consistent on disk and is self-repairing, zdb should only be run under the direction [of] a support engineer.") Checks and fixes for some problems the developers have observed in the wild are implemented in-kernel. The best known of these in-kernel repair facilities is the automatic repair of a damaged block with two copies, replacing the copy which does not match the block's checksum with the good copy if available. Since all metadata has at least two copies, this fixes most data corruption (the exceptions include things like in-memory block corruption). This collection of features definitely qualifies as file system check and repair, but people will argue whether they should be called fsck or not. Which fsck do you mean?We've seen fsck in all its infinite glory, everything from a simple traversal of the file system metadata to groveling through the entire file system cleaning up after a simple-minded file system. Sometimes the names of the programs implementing file system check and repair have improved on unpronounceable fsck (xfs_repair), and sometimes they are just funny (wafliron). One thing is for sure: fsck is an overloaded word, with as many interpretations as there are listeners. Until the file systems community comes up with new terminology, you'll be best served by defining exactly what you mean by "fsck" - "file system consistency check," "file system inconsistency repair," or other unwieldy descriptions. (Note to readers: Lots more kinds of fsck exist - for example, I didn't cover any flash file systems, which tend to be different in very interesting ways. Please add comments about other kinds of fsck, or details on the ones described here. And of course, your fsck war stories. - V.H.)
Video4Linux2 part 7: ControlsWith the completion of part 6 of this series, we now know how to set up a video device and transfer frames back and forth. It is a well known fact, however, that users can be hard to please; not content with being able to see video from their camera device, they immediately start asking if they can play with parameters like brightness, contrast, and more. These adjustments could be done in the video application, and sometimes they are, but there are advantages to doing them in the hardware itself when the hardware has that capability. A brightness adjustment, for example, might lose dynamic range if done after the fact, but a hardware-based adjustment may retain the full range that the sensor is capable of delivering. Hardware-based adjustments, obviously, will also be easier on the host processor.Current hardware typically has a wide range of parameters which can be adjusted on the fly. Just how those parameters work varies widely from one device to the next, though. An adjustment as simple as "brightness" could involve a straightforward register setting, or it could require a rather more complex change to an obscure transformation matrix. It would be nice to hide as much of this detail from the application as possible, but there are limits to how much hiding can be done. An overly abstract interface might make it impossible to use the hardware's controls to their fullest potential. The V4L2 control interface tries to simplify things as much as possible while allowing full use of the hardware. It starts by defining a set of standard control names; these include V4L2_CID_BRIGHTNESS, V4L2_CID_CONTRAST, V4L2_CID_SATURATION, and many more. There are boolean controls for features like white balance, horizontal and vertical mirroring, etc. See the V4L2 API spec for a full list of predefined control ID values. There is also a provision for driver-specific controls, but those, clearly, will generally only be usable by special-purpose applications. Private controls start at V4L2_CID_PRIVATE_BASE and go up from there. In typical fashion, the V4L2 API provides a mechanism by which an application can enumerate the available controls. To that end, they will make ioctl() calls which end up in a V4L2 driver via the vidioc_queryctrl() callback:
int (*vidioc_queryctrl)(struct file *file, void *private_data,
struct v4l2_queryctrl *qc);
The driver will normally fill in the structure qc with information about the control of interest, or return EINVAL if that control is not supported. This structure has a number of fields:
struct v4l2_queryctrl
{
__u32 id;
enum v4l2_ctrl_type type;
__u8 name[32];
__s32 minimum;
__s32 maximum;
__s32 step;
__s32 default_value;
__u32 flags;
__u32 reserved[2];
};
The control being queried will be passed in via id. As a special case, the application can supply a control ID with the V4L2_CTRL_FLAG_NEXT_CTRL bit set; when this happens, the driver should return information about the next supported control ID higher than the one given by the application. In any case, id should be set to the ID of the control actually being described. All of the other fields are set by the driver to describe the selected control. The data type of the control is given in type; it can be V4L2_CTRL_TYPE_INTEGER, V4L2_CTRL_TYPE_BOOLEAN, V4L2_CTRL_TYPE_MENU (for a set of fixed choices), or V4L2_CTRL_TYPE_BUTTON (for a control which performs some action when set and which ignores any given value). name describes the control; it could be used in the interface presented to the user by the application. For integer controls (only), minimum and maximum describe the range of values implemented by the control, and step gives the granularity of that range. default_value is exactly what it sounds like - though it is only applicable to integer, boolean, and menu controls. Drivers should set control values to their default at initialization time only; like other device parameters, they should persist across open() and close() calls. As a result, default_value may well not be the current value of the control. Inevitably, there is a set of flags which further describe a control. V4L2_CTRL_FLAG_DISABLED means that the control is disabled; the application should ignore it. V4L2_CTRL_FLAG_GRABBED means that the control, temporarily, cannot be changed, perhaps because another application has taken it over. V4L2_CTRL_FLAG_READ_ONLY marks controls which can be queried, but which cannot be changed. V4L2_CTRL_FLAG_UPDATE means that adjusting this control may affect the values of other controls. V4L2_CTRL_FLAG_INACTIVE marks a control which is not relevant to the current device configuration. And V4L2_CTRL_FLAG_SLIDER is a hint that applications should represent the control with a slider-like interface. Applications might just query a few controls which have been specifically programmed in, or they may want to enumerate the entire set. In the latter case, they will start at V4L2_CID_BASE and step through V4L2_CID_LASTP1, perhaps using the V4L2_CTRL_FLAG_NEXT_CTRL flag in the process. For controls of the menu variety (type V4L2_CTRL_TYPE_MENU), applications will probably want to enumerate the possible values as well. The relevant callback is:
int (*vidioc_querymenu)(struct file *file, void *private_data,
struct v4l2_querymenu *qm);
The v4l2_querymenu structure looks like:
struct v4l2_querymenu
{
__u32 id;
__u32 index;
__u8 name[32];
__u32 reserved;
};
On input, id is the ID value for the menu control of interest, and index is the index value for a specific menu value. Index values start at zero and go up to the maximum value returned from vidioc_queryctrl(). The driver will fill in the name of the menu item; the reserved field should be set to zero. Once the application knows about the available controls, it will likely set about querying and changing their values. The structure used in this case is relatively simple:
struct v4l2_control
{
__u32 id;
__s32 value;
};
To query a specific control, an application will set id to the ID of the control and make a call which ends up in the driver as:
int (*vidioc_g_ctrl)(struct file *file, void *private_data,
struct v4l2_control *ctrl);
The driver should set value to the current setting of the control. Of course, it should also be sure that it knows about this specific control and return EINVAL if the application attempts to query a nonexistent control. Attempts to query button controls should also return EINVAL. A request to change a control ends up in:
int (*vidioc_s_ctrl)(struct file *file, void *private_data,
struct v4l2_control *ctrl);
The driver should verify the id and make sure that value falls within the allowed range. If all is well, the new value should be set in the hardware. Finally, it is worth noting that there is a separate extended controls interface supported with V4L2. This API is meant for relatively complex controls; in practice, its main use is for MPEG encoding and decoding parameters. Extended controls can be grouped into classes, and 64-bit integer values are supported. The interface is similar to the regular control interface; see the API specification for details.
Patches and updates Kernel trees
Core kernel code
Device drivers
Filesystems and block I/O
Memory management
Architecture-specific
Security-related
Virtualization and containers
Benchmarks and bugs
Miscellaneous
Page editor: Jake Edge Distributions News and Editorials Vyatta Community EditionLast week this column was about SmoothWall Express, an open source router/firewall distribution. This week I decided to try out Vyatta Community Edition 2.2. At the end of the day though, my network computer is back to running SmoothWall Express.Vyatta requires registration to download the Community Edition, but once registered you have access to a CD ROM image for the Community Edition, the VMWare Virtual Appliance, and access to the source code. Just as SmoothWall Express is the open source version of the company's commercial software, the company Vyatta has a subscription release available only to paying customers and the freely available Community Edition. First I found the Quick Evaluation Guide (PDF) on the download page. Later I found a documentation page with several more PDF files. I downloaded the Quick Evaluation Guide from the download page and copied it to my laptop so I could follow it while setting up Vyatta. One could print the thirteen page document, but as I run a mostly paperless office, that was not my first thought. There is a webinar series available, the next routing webinar is scheduled for September 11 and one must be registered to attend. Ok for those who plan ahead, but not so good for instant gratification. They also have video demos and screenshots of a Graphical User Interface, although the GUI doesn't seem to be part of the Community Edition. My 64-bit desktop machine doesn't run Macromedia Flash, so I couldn't check out the videos. The Quick Eval Guide that I downloaded proudly proclaimed that it was once a Microsoft Word file, before it's conversion to PDF. One presumes that many of Vyatta's customers are using this distribution to secure and route a mostly Windows network. It contains a series of commands to be typed on command line of the configuration routine. Vyatta CE includes standard WAN (wide area network) routing protocols such as RIP (Routing Information Protocol), OSPFv2 (Open Shortest Path First version 2), and BGPv4 (Border Gateway Protocol version 4). For the LAN (local area network) portion it includes intranet networking protocols such as DHCP (Dynamic Host Configuration Protocol), VRRP (Virtual Router Redundancy Protocol) and SNMP. I can only connect to my ISP using DHCP, which doesn't seem to be available for the outgoing connection. Is Vyatta right for you? That's between you and your networking/firewalling needs. It is not right for me, unless I completely missed the ability to use DHCP for establishing an outgoing connection. Update: Dave Roberts at Vyatta contacted me with some comments and corrections about this article. While he confirmed that Vyatta does not, at this time, include DHCP for outgoing connections, he did say that are working on it and expect that it will be available early in 2008. This top enhancements page shows DHCP for clients at the top of the list. When I said that the GUI wasn't part of the community edition, I was wrong. I didn't poke around hard enough but it is mentioned in the Quick Start Guide (on page 53), which can be found on the documentation page. The GUI is disabled by default, but it's easy to turn on, and it is demonstrated in the videos. Registration is not required just to download the Community Edition. You use the "Skip It" button. Also the Quick Start Guide and the Eval Guide are available without registration. Registration is required for some of the advanced documentation. Vyatta is a high end product, more often used in large cross-platform environments. It is not really geared toward the tiny home network, although it should work for most. Vyatta really does appear to be a nice product and I'll look forward to giving it another try in the future.
New Releases ALT Linux 4.0 Personal DesktopALT Linux has released (in Russian) version 4.0 Personal Desktop. ALT 4.0 Personal Desktop is a Russian desktop distribution for home and office use, with OpenOffice.org, WINE, graphics applications, multimedia, support for the latest hardware technologies, and much more.
The first CD with LFS-6.3The LiveCD team has announced the release of the first LiveCD with the Linux From Scratch 6.3 book for x86-based computers. "There are some known bugs and missing features that were present in the 6.2 series of CDs (e.g., no loop-aes support), thus the CDs are not called "stable", but for most people, they should be good enough to build LFS-6.3 and ask for support online."
Distribution News CentOS Virtualization SIG createdThe CentOS team has announced the creation of its first Special Interest Group (SIG): the Virtualization SIG. A SIG is a smaller group within the CentOS project that focuses on a small set of issues, in order to either create awareness or to focus development along a specific topic.
Debian reintroduces 0-day NMUs for RC and Release Goal bugs older than 7 daysThe amount of release-critical bugs has increased since the release of Etch. The 0-day NMU policy was successful before, so it has been reintroduced as an incentive for both maintainers and NMUers to take care of RC bugs. So begins an everlasting Bug Squashing Party.
packages.debian.org updatedpackages.debian.org was updated to the new code base that was already available from packages.debian.net. "This is a pretty big update that affects almost all features of packages.debian.org and includes some behavioural changes." Click below for highlights and known regressions. See also these associated changes to mail handling.
forums.gentoo.org leaves the webGentoo forums will be unavailable from September 8, 2007 until sometime on September 10th or 11th as the database backend will be upgraded to MySQL v5.
Mandriva First to Demonstrate KDE/Linux Desktop on the New Intel MID platformMandriva has issued a press release on a prototype of the Mandriva Linux distribution with KDE running on the new Intel Mobile Internet Device (MID) platform at the aKademy 2007 conference. Videos of the Mandriva MID prototype are available here.
Ubuntu Tribe 6 Milestone to Focus on BugfixingUbuntu QA, GNOME, Linux, installer and other teams have decided not to make a formal release for Tribe 6, but rather to use it as a milestone for bugfixing.
Distribution Newsletters Foresight Linux Newsletter Issue 6 (August) out!The August edition of the Foresight Linux Newsletter features an update on the Foresight Linux 2.0 development and release dates, upcoming speaking engagements by members of the Foresight Linux team, and an introduction and overview to PackageKit.
Ubuntu Weekly News: Issue #55The Ubuntu Weekly Newsletter for September 1, 2007 covers the announcement of the next Ubuntu release "Hardy Heron 8.04", Full Circle's latest issue, the Month of Ubuntu Screen Casts, Gutsy Gibbon's release parties, and more.
DistroWatch Weekly, Issue 218The DistroWatch Weekly for September 3, 2007 is out. "If you have only recently discovered this web site and the joy of testing the hundreds of different distributions and live CD available on the market, then you need to learn one essential skill: how to correct a faulty screen resolution that many of these products fail to set up correctly. Today's featured article lists the necessary steps. In the news section, Canonical has announced Ubuntu 8.04 "Hardy Heron" LTS, FreeBSD has unveiled the first alpha of its all-new point-and-click system installer, Debian has updated the backend of its package database infrastructure, and the German Mandriva user community has released the first English issue of "MagDriva", a magazine dedicated to all fans and users of Mandriva Linux. Finally, we are pleased to announce that the recipient of the DistroWatch.com August 2007 donation is the lighttpd project."
Distribution meetings Gentoo Down Under Mini-conf - Call for PapersThere will be a Gentoo mini-conf at LCA, slated to run for half a day on Tuesday January 29, 2008. This is the call for papers and presentations.
Newsletters and articles of interest Ubuntu Xorg maintainer demonstrates bulletproof X (ars technica)ars technica looks at the "BulletProof-X" feature planned for Ubuntu's Gutsy release. "If Xorg fails to start, the failsafe mode will initiate with minimalistic settings, low resolution, and a limited number of colors. The failsafe mode also automatically runs Ubuntu's new GTK-based display configuration utility so that users can easily test various display settings and choose a configuration that will work properly with their hardware. The display configuration utility provides a simple mouse-driven interface that is very intuitive. The configuration utility even has limited multihead [support], but unfortunately doesn't support more than two screens yet."
The next 'business' Ubuntu is on its way (Linux-Watch)Linux-Watch looks forward to Ubuntu 8.04 aka the Hardy Heron. "The next Ubuntu Linux distribution with long-term support, "Hardy Heron," Ubuntu 8.04, will be released in April 2008. Canonical, the company behind Ubuntu, like Red Hat with Fedora and Red Hat Enterprise Linux and Novell with openSUSE and SUSE Linux, releases both a community version and a version for businesses or individuals who want to rely on a distribution with long-term technical support. Unlike Red Hat and Novell, though, Canonical doesn't separate the two versions with different names."
Distribution reviews DIY Linux live CD -- the really easy way (DesktopLinux.com)DesktopLinux.com takes a look at Custom NimbleX 2. "This lesser known Slackware-derived project offers a Web-based tool that lets users concoct, and then download, their own customized live CD Linux images -- in minutes! "I am pleased to announce ... that I just released the Release Candidate of ... Custom NimbleX 2," wrote chief maintainer Bogdan Radulescu. "It allows you to generate your customized Linux distribution by choosing what packages you want to have and it also allows you to configure several other stuff like the default wallpaper, volumes, sounds, greetings, passwords and the language of the interface.""
Page editor: Rebecca Sobol Development RF hacking with GNU RadioGNU Radio is an open-source software project which controls some simple hardware in order to create arbitrarily modulated radio signals. According to the FSF listing:
GNU Radio is a collection of software that when combined with minimal hardware, allows the construction of radios where the actual waveforms transmitted and received are defined by software: it turns the digital modulation schemes used in high performance wireless devices into software problems.
Waveforms are generated as sampled digital signals, converted from digital to analog via a wideband DAC and then possibly upconverted from IF to RF. The receiver uses a wideband Analog to Digital Converter (ADC) that captures all the channels of the software radio node. The receiver then extracts, downconverts and demodulates the channel waveform using software on a general purpose processor.
![[GNU Radio]](/images/ns/gnuradio.png)
The Wikipedia entry for GNU Radio explains some of the project's history: "Philanthropist John Gilmore initiated and has sustained GNU Radio with the funding of $320,000 (US) to Eric Blossom for code creation and project management duties." "GNU Radio began as a fork of the Pspectra code that was developed by the SpectrumWare project at MIT. The Pspectra SDR design utilized a modular pipeline structure and the programmability of the Python programming language for easy configuration and flexibility. In 2004 a complete "rewrite" of the GNU Radio was completed but much of the original Pspectra code and structure remains." To use the GNU Radio software, one must acquire some hardware in the form of the Universal Software Radio Peripheral. The USRP consists of a motherboard with a USB 2.0 interface, four D/A converters, four A/D converters, an Altera FPGA chip, and slots for two transmitter and two receiver daugherboards. The full hardware setup is not inexpensive at $850. Hardware subsets are available for less. The GNU Radio code is a combination of Python and C++. The wxPython library is used for GUI functionality on the host system, control information is sent to the radio peripheral via USB. Eric Blossom's 2004 paper Exploring GNU Radio explains the project in more detail. Some of the applications of GNU Radio include:
A device that can create arbitrary waveforms via software is likely to get the attention of the regulatory agencies. From Eric Blossom's paper: "Every revolution has its political issues. Free software for building radios is troublesome to some people. In the US, we've run into opposition from the Motion Picture Association of America and its attempt with the Broadcast Flag to restrict the kinds of receivers that can be built for over-the-air digital TV. The US Federal Communications Commission has issued a Notice of Proposed Rule Making (NPRM) concerning Cognitive Radio Technologies and Software Defined Radios. Several troublesome issues are raised in the NPRM, including restricting the sale of high-speed digital-to-analog converters, requirements for digital signatures or similar methods to keep unauthorized software out of software radio hardware and new restrictions on radios built for the amateur radio market." GNU Radio version 3.0.4 was announced last July, it featured one bug fix and a change of license to GPLv3. To see some of the projects that are being done with GNU Radio, see the Our Users page.
System Applications Database Software Job Scheduler 1.3.2 released (SourceForge)Version 1.3.2 of Job Scheduler has been announced. "The Job Scheduler runs executable files, shell scripts and database procedures automatically (MySQL,PostgreSQL,Firebird,SQL Server,Oracle,DB2). Job Scheduler provides sequential/parallel tasks, job chains and an API, see project web site for details. This is a maintenance release that adds http authentication, minor improvements and quite a bunch of bugfixes to the Job Scheduler."
LiquiBase Core 1.2 released (SourceForge)Version 1.2 of LiquiBase has been announced, it adds new features and bug fixes. LiquiBase is: "A tool to manage database changes and refactorings. All changes to a database are stored in XML files that are stored in version control with other source code. A graphical IDE is also available."
PostgreSQL Weekly NewsThe September 3, 2007 edition of the PostgreSQL Weekly News is online with the latest PostgreSQL DBMS articles and resources.
SQLite 3.5.0 alpha releasedVersion 3.5.0 alpha of the SQLite DBMS has been announced. " The OS interface layer and the memory allocation subsystems in SQLite have been reimplemented. The published API is largely unchanged but the (unpublished) OS interface has been modified extensively. Applications that implement their own OS interface will require modification. See 34to35.html for details. This is a large change. Approximately 10% of the source code was modified. We are calling this first release "alpha" in order to give the user community time to test and evaluate the changes before we freeze the new design."
Interoperability Samba 4.0.0 alpha1 releasedVersion 4.0.0 alpha1 of Samba has been announced. "Samba 4 is the ambitious next version of the Samba suite that is being developed in parallel to the stable 3.0 series. The main emphasis in this branch is support for the Active Directory logon protocols used by Windows 2000 and above. Samba 4 is currently not yet in a state where it is usable in production environments."
Web Site Development lighttpd 1.4.17 releasedVersion 1.4.17 of lighttpd, a light weight web server, is out. " Ok. We broke it. And yes it took longer than expected to fix it. Anyway. It was worth to wait. We fixed lots of bugs in this release."
Miscellaneous Conky 1.4.7 released (SourceForge)Version 1.4.7 of Conky, a system monitor for X, is available. "This is the next maintenance release for Conky, prompted by bugs introduced in 1.4.6. Also notable is changes/clarifications made to licensing. If you have any problems with the licensing changes (ie. someone got left out of AUTHORS) please let us know."
Desktop Applications Audio Applications jackmix 0.4 releasedVersion 0.4 of jackmix, a mixer application for the Jack Audio Connection Kit, is out. "Whats new since 0.3? Since 0.3 can save its own state (and load it again) it was only a small step to include lash-support. Well, it took some time after the last release but thats because I had to be real busy for work and university. And it seemed to be a bug somewhere in the new lash-part but currently I can't reproduce it, so I think I just release this version before it gets really old..."
Xhippo 3.5 releasedStable version 3.5 of Xhippo has been announced. "Xhippo is a generic playlist manager program that works with mpg123, madplay, bplay, timidity, tracker, xmp, s3mod and almost any other command-line player. It automatically decides which player to use depending on a file's extension; the defaults are set in a config file. It uses textual playlist files, which are compatible with XMMS and other audio players, and can be easily generated with standard command-line tools."
Business Applications OrangeHRM 2.2.0.3 released (SourceForge)Version 2.2.0.3 of OrangeHRM, a human resources information system (HRIS), has been announced. "This is latest stable version of the system mainly contains the implementation of suggested improvements and bug fixes."
Desktop Environments GNOME 2.19.91 releasedVersion 2.19.91 of the GNOME desktop, aka version 12.20.0 Beta 2, has been announced. "This is our eighth development release on our road towards GNOME 2.20.0, which will be released in September 2007. All new features should all be there, so your mission is simple : Go download it. Go compile it. Go test it. And go hack on it, document it, translate it, fix it."
GARNOME 2.19.91 releasedVersion 2.19.91 of GARNOME, the bleeding-edge GNOME distribution, is out. "This release includes all of GNOME 2.19.91 plus a bunch of updates that were released after the GNOME freeze date. This is the eighth release in the unstable cycle, with more, err... fixes added. It is for anyone who wants to get his hands dirty on the development branch, or who'd like to get a peek at future features."
GNOME Software AnnouncementsThe following new GNOME software has been announced this week:
KDE 4.0 release delayedThe KDE 4 release team has sent out a new schedule which includes a two-month delay in the expected release of this long-awaited upgrade. The final release can now be expected around the end of the year.
KDE Software AnnouncementsThe following new KDE software has been announced this week:
Xorg Software AnnouncementsThe following new Xorg software has been announced this week:
Encryption Software KeePass 1.08 released (SourceForge)Version 1.08 of KeePass has been announced. "KeePass is a free password manager, which helps you to manage your passwords in a secure way. You can put all your passwords in one database, which is locked with one master password or a key file. So you only have to remember one single master password or select the key file to unlock the whole database. Databases are encrypted using very secure encryption algorithms (AES/Rijndael, Twofish)."
OpenSSH 4.7 releasedVersion 4.7 of OpenSSH, a secure remote communication system, is out. This release fixes some security problems and bugs and adds some new functionality.
Financial Applications SQL-Ledger 2.8.8 announcedVersion 2.8.8 of SQL-Ledger, a web-based accounting system, is out with lots of new features and some bug fixes. See the What's New document for details.
Imaging Applications Java Mass JPEG Resizer Tool 0.6 released (SourceForge)Version 0.6 of the Java Mass JPEG Resizer Tool is out. "The "Java Mass JPEG Resizer Tool" has following Features Resize all JPEG Images of a Directory, Create Webgalleries, Pack it to an ZIP File for E-Mail Attachments."
Mail Clients Claws Mail 3.0.0 announcedVersion 3.0.0 of the Claws Mail email client has been announced. This version adds a number of new features and features a change to the GPLv3 license. See the news listing for details.
Multimedia Gnash 0.8.1 releasedVersion 0.8.1 of Gnash is out with new capabilities and efficiency improvements. "The forth alpha release of Gnash has just been made at version 0.8.1. Gnash is a GPL'd Flash movie player and browser plugin for Firefox, Mozilla, Konqueror, and Opera. Gnash supports many SWF v7 features and ActionScript2 classes. Gnash also runs on many GNU/Linux distributions, embedded GNU/Linux, FreeBSD, NetBSD, OpenBSD, non x86 processors, and 64 bit architectures."
Music Applications horgand 1.11 releasedVersion 1.11 of horgand, an organ synthesizer, is out with the following changes: "New features including, stereo operators, edit/save engine sound parameters for each sound, FLTK graphic options on command line, engine sound transpose, window icons, new file format and new sound presets. Improved volume normalize, chorus linear interpolation, tremolo and rotary DSP effects. Fixed bugs including preset at first time, Master Volume, preset at load bank and other small bugs."
LiveMix first releaseVersion 0.4 of LiveMix, the initial release, is out. "LiveMix is a mix table for live performances designed for sound technician (not for musician as usual !) It actually will use Jack and LADSPA ad backend."
MusE 0.9 announcedVersion 0.9 of MusE, a multi-track midi/audio sequencer with support for internal and external software synthesizers, is out. "MusE has been in transition towards a redesign dubbed MusE 1.0 and there wasn't supposed to be any more development in the old (0.7,0.8, now 0.9) branch. But, due to fresh developer interest and lots of angry users, we decided to resurrect the old codebase :)"
News Readers Liferea 1.4.0 (stable) (SourceForge)Stable version 1.4.0 of Liferea has been announced. "Liferea (Linux Feed Reader) is a GTK desktop news aggregator for online news feeds and weblogs. The project focus is on simplicity and easy installation. This release adds comment feed support and duplicate detection. It improves the proxy handling and uses a sqlite backend for headlines storage."
Office Suites OpenOffice.org NewsletterThe August, 2007 edition of the OpenOffice.org Newsletter is out with the latest OO.o office suite articles and events.
Science libquantum enters new areas of quantum simulationVersion 0.9.1 of libquantum, a free quantum simulator, has been announced. "The new release contains an interface for numerically solving the Schroedinger equation. "This essentially allows the simulation of arbitrary problems within quantum mechanics", says Hendrik Weimer, physicist and libquantum core developer. A version jump from 0.2.4 to 0.9.1 prepares the transition towards a stable and a development branch."
Languages and Tools Caml Caml Weekly NewsThe September 4, 2007 edition of the Caml Weekly News is out with new Caml language articles.
PHP PHP 5.2.4 releasedVersion 5.2.4 of PHP has been released. "The PHP development team would like to announce the immediate availability of PHP 5.2.4. This release focuses on improving the stability of the PHP 5.2.X branch with over 120 various bug fixes in addition to resolving several low priority security bugs. All users of PHP are encouraged to upgrade to this release."
Python Python 3.0a1 releasedThe first alpha release of Python 3.0 is available; see the release page for details and downloads. For those who have not been following the Python 3.0 process, the what's new document is a good place to start. The final release is expected to happen about one year from now.
Python-URL! - weekly Python news and linksThe September 3, 2007 edition of the Python-URL! is online with a new collection of Python article links.
Ruby Behavior-Driven Development Using Ruby (Part 2) (O'ReillyNet)O'Reilly has published part two of Gregory Brown's series on Behavior-Driven Development Using Ruby. "Gregory Brown has introduced us to the basic idea of behavior-driven development in his last article. Now, he takes it from abstract to concrete by showing us how to build behavior-driven development into an actual Ruby application."
Tcl/Tk Tcl-URL! - weekly Tcl news and linksThe August 30, 2007 edition of the Tcl-URL! is online with new Tcl/Tk articles and resources.
Libraries Freeverb3 2.0.0 released (SourceForge)Version 2.0.0 of Freeverb3 has been announced. "Freeverb3 library includes high quality freeverb, nreverb and impulse response reverb. Oversampling feature provides higher quality of audio processing. This library includes XMMS plugins, audacious plugins, BMP beep media player plugins and sample programs, which enable you to test the audio effects easily."
Test Suites STAF V3.2.3 is now available (SourceForge)Version 3.2.3 of the Software Testing Automation Framework (STAF), a framework designed to improve the level of reuse and automation in test cases and test environments, has been announced. "There are some new features in STAF V3.2.3 as well as bug fixes and documentation updates."
Version Control GIT 1.5.3 announcedVersion 1.5.3 of the GIT version control system is out with numerous changes.
Page editor: Forrest Cook Linux in the news Recommended Reading Is free and open code a form of infrastructure? How about the humans who write it? (Linux Journal)Doc Searls looks at infrastructure, code and the humans who write it, in his Linux Journal blog. "The success of FOSS requires that we start looking at the sources of sources: human beings, doing constructive work. What kind of public policies might grow on the realization that the sources that matter most are the people who comprise as well as build civilization? What kind of businesses? What kind of civic and public institutions?"
Free ATI drivers for Christmas? (Linux.com)Linux.com looks at how free video drivers are progressing. "Fully-functional video drivers -- ones capable of handling 3-D acceleration -- remain one of the weak points of free software. The Free Software Foundation has declared them a high-priority project. Meanwhile, some distributions and even more users have resorted to using the proprietary drivers offered as free downloads by card manufacturers. One of the main projects attempting to provide complete, free drivers is focusing on developing the Avivo driver for the R500 and R600 cards from AMD/ATI, so-called after a specification first introduced in this line of cards. According to Jerome Glisse, who coordinates the development of the driver, progress is being made in the project, and "maybe by the end of this year, we might have some 3-D acceleration.""
The SCO Problem SCO Asks Judge Kimball for an Entry of Final Judgment (Groklaw)Groklaw covers SCO's latest appeal. "I gather SCO has noticed that the SCO v. IBM litigation won't be nearly so annoying to IBM unless it does something fast about Judge Dale Kimball's August 10th ruling, which pared that case, like all of SCO's cases, down to almost nothing but the counterclaims against SCO. So it's asking the court to enter a final judgment on certain matters the ruling decided, so it can seek an immediate appeal on those issues, such as whether it owns the UNIX and Unixware copyrights after all and whether Novell has the authority to tell SCO to waive any purported breach of contract by licensees. Those are the two that shot arrows straight through SCO's heart."
Companies HP to preload Linux on SMB desktop PCs in Australia (Techlogg.com)Techlogg.com reports that HP will sell PCs loaded with Red Hat Enterprise Linux 5. "US-based PC giant Hewlett-Packard today announced that it will begin offering Linux preloaded on one of its desktop PC ranges in the Australian market. The company says it will offer Red Hat Enterprise Linux 5 Desktop preloaded on its new HP dx2250 desktop PC with an eye to growing its share of the small to medium business (SMB) market. The HP Compaq dx2250 desktop PC is a range of systems under the one banner offering AMD processor technology based on Sempron, Athlon 64 and Athlon 64 X2 chips."
Microsoft employee offered incentives for OOXML support (LinuxWorld)Here's a LinuxWorld story about the OOXML vote end game. "Andrew Updegrove, a well-known backer of the rival Open Document Format for Office Applications (ODF) and an attorney at Gesmer Updegrove LLP in Boston, said Microsoft's tactics make the outcome of the Open XML vote crucial to the future of the technology standards process. 'I personally believe that this result is essential, due to the severe impact that the events of the past several months have had on the integrity of the standards development process,' he wrote in an e-mail."
Microsoft Open XML standards vote foments politics, dismay (News.com)News.com has an overview of the voting process for fast-tracking Microsoft's ISO application for its Open XML file formats. "'It's clear that whatever the vote, OOXML will not be a JTC1 standard for a long, long time, no matter what people say next week. It's also clear that unless the process is quickly terminated with OOXML being rejected as unsuitable with comments unresolvable, it will churn on and on and on, no matter what you feel about it or the OOXML spec,' Bob Sutor, IBM's vice president of open source and standards and a vocal Microsoft critic, wrote this week in his blog."
ISO votes against fast tracking Microsoft's Office Open XML (ars technica)It appears that Microsoft's bid to have its Open XML file format fast-tracked has failed, perhaps surprisingly given the alleged voting irregularities. ars technica reports on the vote. "With the vote going against Microsoft, the proposed standard for OOXML will have to revised in order to take into account the 'with comments' votes. This could entail changes to the file format itself, which would then require updates to Office 2007 in order to make it fully compliant with any revisions to the OOXML format. There will be a week-long Ballot Resolution Meeting held in February or March of 2008 where further work on the standard will take place. Another vote on OOXML will then be held at the end of the meeting."
Palm tables Linux-based Foleo (LinuxDevices)LinuxDevices covers Palm's decision to drop the planned Linux-based Foleo, which was supposed to be an peripheral for their Treo smartphones. There are plans to revamp the device after hearing generally negative market feedback. "Palm announced the Foleo in May, describing it as a new class of mobile device designed to expand the email, Internet, and productivity application capabilities of mobile phones such Palm's Treo, by adding a full-size keyboard and a larger screen. In announcing the Foleo, Palm Founder Jeff Hawkins predicted it would prove more successful than Palm's original Palm Pilot, and more successful than Palm's current Treo smartphones."
Legal E-voting reform bill scheduled for House vote this week (ars technica)ars techica takes a look at a bill coming up for a vote in the US House of Representatives. The bill would mandate voter-verifiable paper trails for electronic voting machines. "The Electronic Frontier Foundation (EFF) is one of several advocacy groups calling for legislators to vote in favor of HR 811 despite its deficiencies. As the EFF points out, the current text of the bill still establishes a compulsory paper trail, a crucial reform that limits the potential for exploitation of security vulnerabilities and decreases the risk of serious problems in the event of machine failures. The EFF also expresses 'profound disappointment' with the removal of source code disclosure provisions. 'Our support for HR 811 is tempered by profound disappointment that one of the bill's pillars has been watered down to the point of ineffectiveness due to pressure from the proprietary software industry,' the EFF said in a statement. 'We call on Rep. Zoe Lofgren and the other members of the Elections Subcommittee to promptly fix this provision... before the bill makes it to the floor of the House.'"
Resources Troubleshooting Linux Audio, Part 3b (Linux Journal)Linux Journal has published Part 3b in a series on Troubleshooting Linux Audio by Dave Phillips. "In this final section I'll present some MIDI-specific troubleshooting tips, along with a brief description of the setup here at StudioDave, a few closing remarks, and of course some links to the Linux music-maker du jour."
September issue of Linux Gazette is outLinux Gazette #142, for September 2007 is out. This month's articles include "Preventing Domain Expiration", "Writing PostgreSQL Functions in C, Part Two", "SMTP Authentication with Postfix", and more.
Optical Character Recognition With Tesseract OCR On Ubuntu 7.04 (HowtoForge)Oliver Meyer explains how to use Tesseract for optical character recognition on an Ubuntu system. "This document describes how to set up Tesseract OCR on Ubuntu 7.04. OCR means "Optical Character Recognition". The resulting system will be able to convert images with embedded text to text files. Tesseract is licensed under the Apache License v2.0."
Python for system administrators (developerWorks)IBM developerWorks covers the use of Python scripts for system administration. "As a system administrator, you run across numerous challenges and problems. Managing users, disk space, processes, devices, and backups can cause many system administrators to lose their hair, good humor, or sanity. Shell scripts can help, but they often have frustrating limitations. This is where a full-featured scripting language, such as Python, can turn a tedious task into an easy and, dare I say it, fun one."
Reviews A First Look at KDE 4 Beta 2 (ars technica)ars technica takes a first look at KDE 4 beta 2. "As part of Ars Technica's continuing coverage of the KDE 4.0 development cycle, I took the opportunity today to sit down with a fresh build of KDE 4 from KDE's publicly accessible source tree. My tests are conducted on a 64-bit Kubuntu 7.04 system with very few modifications other than the installation of a bunch of -dev packages that were required to build the many parts of KDE 4. I built the whole thing to be self-contained within a single user's home folder, so that I can safely test it without making any permanent changes to my otherwise perfectly functional KDE 3.5.7 machine. To my surprise, today is the first day that I can say that I'm really comfortable using KDE 4..."
PhpGedView puts your ancestors on the Web (Linux.com)Linux.com has a review of PhpGedView, which allows entry and display of genealogical data. "For each person in the system you can add a tremendous amount of data: date and place of birthday and death, job, religion, and photos, just to name a few. Most of the data you insert can be used for statistical reports and diagrams. For example, you can see all the people alive in 1890, or display birthplaces with little flags on Google Maps."
Page editor: Forrest Cook Announcements Non-Commercial announcements Advice on relicensing from the SFLCThe Software Freedom Law Center has set out a file of advice for those who would incorporate non-GPL software into GPL-licensed projects. "Many free software projects grant broad copyright permissions to recipients of their programs. In many cases, these permissions are broad enough to allow the code to be incorporated into larger works that are licensed under the GNU GPL. When incorporating such code into GPL'd projects, however, care must be taken to preserve all appropriate copyright, permission, and disclaimer of warranty notices. Failure to do so can result in infringement of the copyright on the incorporated code."
Commercial announcements AMD to open up graphics specsA quick report from the kernel summit: AMD's representative at the summit has announced that the company has made a decision to enable the development of open source drivers for all of its (ATI) graphics processors from the R500 going forward. There will be specifications available and a skeleton driver as well; a free 2D driver is anticipated by the end of the year. The rest will have to be written; freeing of the existing binary-only driver is not in the cards, and "that is better for everybody." Things are looking good on this front. More in the kernel summit report to come.Update: Christopher Blizzard has posted some more information about what AMD is doing.
Network Appliance suing Sun over ZFSNetwork Appliance is suing Sun over patents alleged to cover parts of the ZFS filesystem. The announcement comes from NetApp's founder and Executive VP Dave Hitz's blog. "This case is especially sensitive, because Sun has released ZFS as open source. It is admirable to contribute to open source. I have done it personally, although it was a long time ago that I was writing code, and NetApp has also contributed as a company. But it doesnt help the open source movement to give away code that is encumbered with someone elses patent rights. The sooner we determine the true status of ZFS, the better it will be for everyone. NetApp certainly doesnt believe that we can somehow erase every copy of ZFS that has been downloaded. (Impossible!) This lawsuit isnt about downloads for personal or non-commercial use; it is about what Sun is doing."
Novell reports financial results for third fiscal quarter 2007Novell, Inc. has announced its third quarter fiscal results for 2007. Its Linux platform product revenues have grown 77% in the last year. "For the quarter, Novell reported net revenue of $243 million, compared to net revenue of $236 million for the third fiscal quarter 2006. The loss from operations for the third fiscal quarter 2007 was $10 million, compared to a loss from operations of $40 million for the third fiscal quarter 2006. The loss available to common stockholders from continuing operations in the third fiscal quarter 2007 was $3 million, or $0.01 loss per common share."
SGI Fiscal Year 2007 reportSGI has sent out an end of Fiscal Year 2007 report. "In August, NASA turned to SGI to acquire the world's largest shared-memory supercomputer as part of NAS Technology Refresh (NTR), a four-phase evaluation and procurement process that eventually will replace the Columbia supercomputer system, powered by SGI(R) Altix(R). Installed in August at the NASA Advanced Supercomputing (NAS) facility at the Ames Research Center at Moffett Field, Calif., the new system is the first supercomputer to operate 2,048 Intel(R) Itanium(R) 2 processor cores and 4TB of memory under a single copy of Linux(R) OS; as such, it is the largest Linux single system image (SSI) in the world."
SGI sets world record for Oracle E-Business Suite performanceSGI has announced that its Altix systems have achieved the fastest performance running Oracle Database 10g. "Running the Oracle E-Business Suite 11i (11.5.10) Benchmark, also known as the Oracle Applications Standard Benchmark (OASB), an SGI(R) Altix(R) 450 system delivered twice the performance of the previous record holder in tests that measure average response times for 2,000 online users. The SGI system also delivered record hourly throughput in Oracle's measurement of order management and payroll batch business processes."
SugarCRM's Community Edition 5.0 beta released under GPLv3SugarCRM Inc. has announced the beta release of Sugar Community Edition 5.0. "SugarCRM Inc., the world's leading provider of commercial free/libre and open source (FLOSS) customer relationship management (CRM) software, today announced the beta availability of Sugar Community Edition 5.0 for download and testing by the Sugar community. Sugar Community Edition 5.0 is being released under the GNU General Public License version 3 (GPLv3), a free software license published by the Free Software Foundation."
New Books SOA in Practice--New from O'Reilly MediaO'Reilly has published the book SOA in Practice by Nicolai Josuttis.
Resources O'Reilly launches Women of Tech technical seriesO'Reilly has launched the Women of Tech article series. "There's no doubt that women coders, developers, designers, and programmers are a powerful force in the modern tech industry, despite their smaller numbers compared to men. At the same time many of the major impacts and innovations of women at every level of the development and evolution of technology--from the first female coders to today's Web 2.0 pioneers--aren't all that well known. But starting now, O'Reilly Media aims to celebrate and give voice to the real-world experiences and concerns of these female trailblazers by publishing a new online series, "Women in Tech.""
Education and Certification Upcoming rPath WebinarrPath has announced that it will hold a webinar on September 5, 2007 at 1:00 pm Eastern time. "Engineering teams are becoming increasingly distributed and the art of building software products is rapidly changing. Even the most nimble teams must rely on informal and on-demand collaboration with team members as well as the customer. With a continuous testing process and end users playing a greater role in the testing process, geographic dispersion of your engineers might be a greater challenge than normal. Join rPath for this web seminar to learn how GlobalLogic, an rPath Strategic Services Partner, uses Velocity, a lightweight process and tools framework, to address these challenges."
FSFE: Advanced international educational platform goes liveThe Free Software Foundation Europe has announced a beta version of the SELF Platform. "The official launch is taking place during a conference on Free Software in Education in the Netherlands, accompanied by satellite launch events in Sweden, Bulgaria, Argentina, Mexico and India with workshops and conferences."
Upcoming Events The Gelato Itanium Conference and ExpoThe next Gelato Itanium Conference and Expo (ICE) will take place on October 1-2, 2007 in Singapore. "This is the first ICE conference specifically targeting enterprise attendees. There will be more enterprise content and focused outreach to ISVs and SIs from the region. Rest assured that we will continue to provide content of interest to research and HPC."
Still time to sign-up for Hack-a-thon IIHack-a-thon II will be held in Austin, Texas on September 22-25, 2007 in conjunction with the Power Architecture Developer Conference. "In this 4 day event, sponsored by IBM and Power.org, Terra Soft will host a 6 node PS3 cluster and hands-on workshop for the installation of Yellow Dog Linux, compute image deployment via Y-HPC, and use of Torque and Moab for job management. Hack-a-thon attendees are invited to work hands-on to test their own parallel and distributed code."
Fifth LinuxChix Brazil ConferenceThe Fifth LinuxChix Brazil conference will be held 7-8 September at IESB University in Brazilia. Talks, tutorials and debates are planned, mostly in Portuguese, but two English language presentations are scheduled as well. More details can be found by clicking below.
PostgreSQL Conference Fall 2007The Fall 2007 PostgreSQL Conference has been announced. "PostgreSQL.Org is having a one day technical conference in Portland, Oregon on October 20th 2007. The conference will be held at Portland State University, and like PDXPGDay during OSCON there will be a dinner and party afterward."
Events: September 13, 2007 to November 12, 2007The following event listing is taken from the LWN.net Calendar.
If your event does not appear here, please tell us about it.
Page editor: Forrest Cook
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
![[Dirk Hohndel]](/images/conf/lce2007/dirk-sm.jpg)
![[Arnd Bergmann]](/images/conf/lce2007/arnd-sm.jpg)